> I see later on that this is only accessible to sysadmins

Well, maybe.  Mass-assignment exploits on Event are probably trivial.